Australian SMS Sender ID Registry to be established

TL;DR

Legislation establishing a new SMS Sender ID Registry (Register) has been introduced by the Australian government. The Register is intended to record entities that send messages by SMS to Australian phone numbers using alphanumeric sender identification (alpha tags). Whether registration will be mandatory or voluntary has not yet been determined but, as there is support for it to be made mandatory, this is an important development to watch for entities that use SMS or MMS to communicate with customers.

What is the Register?

On 26 June 2024, the federal government introduced the Telecommunications Amendment (SMS Sender ID Register) Bill 2024 (Bill). On the 2 July, the Coalition indicated they will support the Bill.^[1] The Bill is the first step in creating an electronic SMS Sender ID Registry that will be established and maintained by the Australian Communications and Media Authority (ACMA).

The Register is designed to bolster existing anti-scam measures (including to disrupt SMS impersonation scams) and forms part of the Australian government’s measures announced in 2023 to combat scams and protect Australians from financial harm. The Register complements the existing telecommunications code known as the Reducing Scam Calls and Scam SMS Industry Code that places obligations on carriers and carriage service providers (C/CSPs) to take certain steps to monitor, block and report scam calls/SMS messages being originated and/or carried over their networks.^[2] Whilst the industry code has had an impact, it is clear that more needs to be done to reduce the volume of scam messages being sent to Australian consumers by SMS.

Will organisations sending messages to recipients in Australia have to register?

It has not yet been determined whether entities must participate in the Register in order to send messages to Australian phone numbers using alphanumeric sender identification (which is where the sender is identified with a name rather than just a phone number). This question of whether the Register is mandatory or voluntary for entities will be decided later in 2024.^[3] However, there is a push for mandatory registration from consumer groups and industry consultation.^[4]

How will the Register work?

The Bill currently requires that an entity must first apply for approval to be on the Register from ACMA.^[5] Once approved, the entity may then apply for one or more sender identifications to be recorded on the Register, subject to ACMA’s requirements.^[6] ACMA will then notify an entity of its decision to either accept or refuse that sender identification on the Register.^[7]

Under a mandatory registration model, entities which send messages with alphanumeric sender identifications would need to register those identifications. Without registration, the entity would need to use a phone number or numeric short code as an identifier instead. This would prevent scammers from sending messages that are falsely identified as being from a legitimate sender, like those in the following examples that appear in the Bill’s explanatory memorandum:

What is the impact on carriers and carriage service providers?

The ACMA’s powers to establish, and maintain, the Register will be inserted into the Telecommunications Act 1997 (Cth) (Telecommunications Act). Once a decision is made as to whether the Register will be mandatory or voluntary, the government has indicated that corresponding rules will be made via an industry standard which will bind C/CSPs. These rules will likely obligate C/CSPs to check if a sender identification is registered and whether the sender is the registered party or their authorised representative and, if use of the Register is mandatory, either:

• prohibit C/CSPs from sending SMS with alphanumeric sender identifications unless they were registered and the sender was the registered party or agent; or
• require C/CSPs to send such messages with a warning or tag that the message may be a scam.

The Telecommunications Act has existing provisions that deal with the development and registration of binding industry standards.  Although this mechanism does not feature in the Bill, it will be effected by existing powers in the Telecommunications Act and (depending how it is structured) could expose C/CSPs to significant civil penalties per contravention. It is also conceivable that a victim of a scam might seek to recover their losses from a C/CSP that failed to comply with an enforceable industry code or standard, if that loss would have been prevented had the code or standard been complied with.

How would the Bill fit into Australia’s current anti-scam framework?

Australia already has a number of laws which address similar subject matter to the Bill:

• Scamming people through SMS/MMS is — obviously — already unlawful and also gives rise to various civil rights and remedies under Australian law on the part of a victim against a scammer (if they can be identified and legal proceedings in Australia are practicable).^[8]
• Entities are already required to accurately identify themselves when sending SMS/MMS that have a commercial purpose.^[9]
• C/CSPs are required to comply with Reducing Scam Calls and Scam SMS Industry Code. ^[10]

The Bill won’t create any new scam-related offences, but it will create a framework for legitimate organisations to differentiate themselves from scammers.  That is, if mandated, only registered senders may identify themselves with an alphanumeric identifier. This would assist with consumer education and identification of likely scammers.  Furthermore, regardless of whether registration is mandatory, legitimate entities may consider using the Register to disrupt the business model of scammers and reduce the level of resources they expend to combat SMS impersonation scams.

Singapore implemented a similar registry — the Singapore SMS Sender ID Registry (SSIR) — in March 2022. Initially, registration was voluntary, but this changed to a mandatory model in 2023.  During the voluntary phase, messages from unregistered senders could still be sent but they were automatically labelled as ‘Likely-SCAM’. In the first year after the implementation of the SSIR, Singapore reported a 64% reduction in scams through SMS.^[11]

What’s next for the Bill?

Assuming that the Bill is passed promptly by the Australian Parliament, the key decision to be made is whether registration will be mandatory. If it is made mandatory, further legislation will be required to introduce a mandate. A telecommunications industry standard will also need to be developed.  Although there is nothing for organisations to do right now, it is important to watch this space as the Register is coming and you should be ready!